Adaptive fraud detection

Abstract

A computer-implemented method includes receiving a new data record associated with a transaction, and generating, using an adaptive model executed by the computer, a score to represent a likelihood that the transaction is associated with fraud. The adaptive model employs feedback from one or more external data sources, the feedback containing information about one or more previous data records associated with fraud and non-fraud by at least one of the one or more external data sources. Further, the adaptive model uses the information about the one or more previous data records as input variables to update scoring parameters used to generate the score for the new data record.

What is claimed: 
     
       1. A computer-implemented method comprising:
 receiving, by one or more programmable processors, a new data record; 
 generating, using a base model executed by the one or more programmable processors, a first score being a first likelihood of the new data record being associated with an undesirable event; 
 generating, when the first likelihood is more than a threshold and using an adaptive model executed by the one or more programmable processors, a second score to represent a second likelihood of the new data record being associated with the undesirable event, the adaptive model receiving feedback from one or more external data sources, the feedback comprising information about one or more previous data records associated with the base model generated by scoring parameters from at least one of the one or more external data sources, the feedback being used to update scoring parameters within the adaptive model that are used to generate the second score; and 
 displaying, a blended score based on at least one of the first score and the second score in real-time, the blended score being applied to predict likelihood of occurrence of the undesirable event; 
 selecting one or more records associated with the undesirable event in response to a score threshold being reached; 
 generating a case for an analyst review based on the one or more selected records; and 
 enhancing, by the one or more programmable processors, the adaptive model's performance by feeding corresponding records and associated fraud feature variables to the adaptive model in response to determining whether the case is fraudulent. 
 
     
     
       2. The computer-implemented method of  claim 1 , wherein the adaptive model receives the information about the one or more previous data records as input variables to update scoring parameters used to generate the second score for the new data record. 
     
     
       3. The computer-implemented method of  claim 2 , wherein each of the one or more external data sources stores the one or more previous data records in a first-in, first-out (FIFO) table. 
     
     
       4. The computer-implemented method of  claim 3 , wherein the adaptive model is based on a Naïve Bayesian model. 
     
     
       5. The computer-implemented method of  claim 1 , further comprising computing probabilities of the one or more previous data records being associated with the undesirable event. 
     
     
       6. The computer-implemented method of  claim 5 , further comprising:
 comparing the new data record with the one or more previous data records; and 
 computing the second likelihood that the new data record is associated with the undesirable event based on the comparing. 
 
     
     
       7. The computer-implemented method of  claim 6 , further comprising combining the second likelihood with the probabilities of the one or more previous data records being associated with the undesirable event to calculate marginal probabilities of the new data record. 
     
     
       8. The computer-implemented method of  claim 7 , further comprising combining the marginal probabilities to compute the posterior probability of the new data record. 
     
     
       9. The computer-implemented method of  claim 8 , wherein the second score is based at least in part on the posterior probability. 
     
     
       10. A computer program product comprising machine-readable media having computer program code that is configured to instruct a programmable processor to:
 receive a new data record; 
 generate, using a base model executed by a computer including the programmable processor, a first score for the new data record, the first score characterizing a first probability that the new data record is associated with an undesirable event; 
 generate, when the first probability is more than a threshold and using an adaptive model that is cascaded with the base model and that is executed by the computer, a second score to represent a second probability that the new data record is associated with the undesirable event, the adaptive model employing feedback from one or more external data sources, the feedback containing information about one or more previous data records associated with the base model generated by scoring parameters from at least one of the one or more external data sources, the second score being blended with the first score to obtain a blended score; and 
 applying at least one of the first score, the second score, and the blended score to predict likelihood of occurrence of the undesirable event; 
 select one or more records associated with the undesirable event in response to a score threshold being reached; 
 generate a case for an analyst review based on the one or more selected records; and 
 enhance, by the programmable processor, the adaptive model's performance by feeding corresponding records and associated fraud feature variables to the adaptive model in response to determining whether the case is fraudulent. 
 
     
     
       11. The computer program product of  claim 10 , wherein the adaptive model receives the information about the one or more previous data records as input variables to update scoring parameters used to generate the second score for the new data record. 
     
     
       12. The computer program product of  claim 11 , wherein each of the one or more external data sources stores the one or more previous data records in a first-in, first-out (FIFO) table. 
     
     
       13. The computer program product of  claim 12 , wherein the adaptive model is based on a Naïve Bayesian model. 
     
     
       14. The computer program product of  claim 10 , wherein the computer program code is further configured to instruct the programmable processor to compute probabilities of the one or more previous data records being associated with the undesirable event. 
     
     
       15. The computer program product of  claim 14 , wherein the computer program code is further configured to instruct the programmable processor to:
 compare the new record with the one or more previous data records; and 
 compute the second probability that the new data record is associated with the undesirable event based on the comparing. 
 
     
     
       16. The computer program product of  claim 15 , wherein the computer program code is further configured to instruct the programmable processor to combine the second probability with the probabilities of the one or more previous data records being associated with the undesirable event to calculate marginal probabilities of the new data record. 
     
     
       17. The computer program product of  claim 16 , wherein the computer program code is further configured to instruct the programmable processor to combine the marginal probabilities to compute the posterior probability of the new data record. 
     
     
       18. The computer program product of  claim 17 , wherein the second score is based at least in part on the posterior probability. 
     
     
       19. The computer program product of  claim 10 , wherein the computer program code is further configured to instruct the programmable processor to transmit the second score to another computer connected to the computer via a communication network. 
     
     
       20. A system comprising:
 at least one programmable processor; and 
 a non-transitory machine-readable medium storing instructions that, when executed by the at least one programmable processor, cause the at least one programmable processor to perform operations comprising:
 receiving a new data record; 
 generating, using a base model, a first score being a first likelihood of the new data record being associated with an undesirable event; 
 generating, when the first likelihood is more than a threshold and using an adaptive model executed by the one or more programmable processors, a second score to represent a second likelihood of the new data record being associated with the undesirable event, the adaptive model receiving feedback from one or more external data sources, the feedback comprising information about one or more previous data records associated with the base model generated by scoring parameters from at least one of the one or more external data sources, the feedback being used to update scoring parameters within the adaptive model that are used to generate the second score; and 
 practically applying at least one of the first score, the second score, or a blend of the first score and the second score to indicate likelihood of occurrence of the undesirable event; 
 selecting one or more records associated with the undesirable event in response to a score threshold being reached; 
 generating a case for an analyst review based on the one or more selected records; and 
 enhancing, by the at least one programmable processor, the adaptive model's performance by feeding corresponding records and associated fraud feature variables to the adaptive model in response to determining whether the case is fraudulent. 
 
 
     
     
       21. The system of  claim 20 , the one or more external data sources storing the one or more previous data records in a queue for various fraud types to identify one or more fraud types that are more likely. 
     
     
       22. The system of  claim 21 , where additional segmentation of fraud by identifying the various fraud types improves the base model's performance.